1/*-
2 * Copyright (c) 2004-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
--- 10 unchanged lines hidden (view full) ---
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#43 $
30 */
31
32#include <sys/types.h>
33
34#include <config/config.h>
35
36#include <sys/dirent.h>
37#ifdef HAVE_FULL_QUEUE_H
--- 24 unchanged lines hidden (view full) ---
62
63#include "auditd.h"
64
65#ifndef HAVE_STRLCPY
66#include <compat/strlcpy.h>
67#endif
68
69/*
70 * XXX The following are temporary until these can be added to the kernel
71 * audit.h header.
72 */
73#ifndef AUDIT_TRIGGER_INITIALIZE
74#define AUDIT_TRIGGER_INITIALIZE 7
75#endif
76#ifndef AUDIT_TRIGGER_EXPIRE_TRAILS
77#define AUDIT_TRIGGER_EXPIRE_TRAILS 8
78#endif
79
80
81/*
82 * LaunchD flag (Mac OS X and, maybe, FreeBSD only.) See launchd(8) and
83 * http://wiki.freebsd.org/launchd for more information.
84 *
85 * In order for auditd to work "on demand" with launchd(8) it can't:
86 * call daemon(3)
87 * call fork and having the parent process exit
88 * change uids or gids.
--- 76 unchanged lines hidden (view full) ---
165 len = strlen(lastfile) + 1;
166 oldname = (char *)malloc(len);
167 if (oldname == NULL)
168 return (-1);
169 strlcpy(oldname, lastfile, len);
170
171 /* Rename the last file -- append timestamp. */
172 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
173 memcpy(ptr, TS, POSTFIX_LEN);
174 if (rename(oldname, lastfile) != 0)
175 auditd_log_err(
176 "Could not rename %s to %s: %m", oldname,
177 lastfile);
178 else {
179 /*
180 * Remove the 'current' symlink since the link
181 * is now invalid.
--- 92 unchanged lines hidden (view full) ---
274 /*
275 * XXX Faulty directory listing? - user should be given
276 * XXX an opportunity to change the audit_control file
277 * XXX switch to a reduced mode of auditing?
278 */
279 return (-1);
280 }
281
282 /*
283 * Finally, see if there are any trail files to expire.
284 */
285 err = auditd_expire_trails(audit_warn_expired);
286 if (err)
287 auditd_log_err("auditd_expire_trails(): %s",
288 auditd_strerror(err));
289
290 return (0);
291}
292
293/*
294 * Start up auditing.
295 */
296static void
297audit_setup(void)
--- 259 unchanged lines hidden (view full) ---
557 break;
558
559 case AUDIT_TRIGGER_INITIALIZE:
560 auditd_log_info("Got audit initialize trigger");
561 if (au_state == AUD_STATE_DISABLED)
562 audit_setup();
563 break;
564
565 case AUDIT_TRIGGER_EXPIRE_TRAILS:
566 auditd_log_info("Got audit expire trails trigger");
567 err = auditd_expire_trails(audit_warn_expired);
568 if (err)
569 auditd_log_err("auditd_expire_trails(): %s",
570 auditd_strerror(err));
571 break;
572
573 default:
574 auditd_log_err("Got unknown trigger %d", trigger);
575 break;
576 }
577}
578
579/*
580 * Reap our children.
--- 103 unchanged lines hidden (view full) ---
684 auditd_log_debug(
685 "Set audit trail min free percent in kernel.");
686
687 /*
688 * Configure host address in the audit kernel information.
689 */
690 err = auditd_set_host();
691 if (err) {
692 if (err == ADE_PARSE) {
693 auditd_log_notice(
694 "audit_control(5) may be missing 'host:' field");
695 } else {
696 auditd_log_err("auditd_set_host() %s: %m",
697 auditd_strerror(err));
698 ret = -1;
699 }
700 } else
701 auditd_log_debug(
702 "Set audit host address information in kernel.");
703
704 return (ret);
705}
706
707/*
708 * Setup and initialize auditd.
709 */
710static void
711setup(void)
--- 111 unchanged lines hidden ---
2 * Copyright (c) 2004-2009 Apple Inc.
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
--- 10 unchanged lines hidden (view full) ---
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 *
29 * $P4: //depot/projects/trustedbsd/openbsm/bin/auditd/auditd.c#43 $
30 */
31
32#include <sys/types.h>
33
34#include <config/config.h>
35
36#include <sys/dirent.h>
37#ifdef HAVE_FULL_QUEUE_H
--- 24 unchanged lines hidden (view full) ---
62
63#include "auditd.h"
64
65#ifndef HAVE_STRLCPY
66#include <compat/strlcpy.h>
67#endif
68
69/*
70 * XXX The following are temporary until these can be added to the kernel
71 * audit.h header.
72 */
73#ifndef AUDIT_TRIGGER_INITIALIZE
74#define AUDIT_TRIGGER_INITIALIZE 7
75#endif
76#ifndef AUDIT_TRIGGER_EXPIRE_TRAILS
77#define AUDIT_TRIGGER_EXPIRE_TRAILS 8
78#endif
79
80
81/*
82 * LaunchD flag (Mac OS X and, maybe, FreeBSD only.) See launchd(8) and
83 * http://wiki.freebsd.org/launchd for more information.
84 *
85 * In order for auditd to work "on demand" with launchd(8) it can't:
86 * call daemon(3)
87 * call fork and having the parent process exit
88 * change uids or gids.
--- 76 unchanged lines hidden (view full) ---
165 len = strlen(lastfile) + 1;
166 oldname = (char *)malloc(len);
167 if (oldname == NULL)
168 return (-1);
169 strlcpy(oldname, lastfile, len);
170
171 /* Rename the last file -- append timestamp. */
172 if ((ptr = strstr(lastfile, NOT_TERMINATED)) != NULL) {
173 memcpy(ptr, TS, POSTFIX_LEN);
174 if (rename(oldname, lastfile) != 0)
175 auditd_log_err(
176 "Could not rename %s to %s: %m", oldname,
177 lastfile);
178 else {
179 /*
180 * Remove the 'current' symlink since the link
181 * is now invalid.
--- 92 unchanged lines hidden (view full) ---
274 /*
275 * XXX Faulty directory listing? - user should be given
276 * XXX an opportunity to change the audit_control file
277 * XXX switch to a reduced mode of auditing?
278 */
279 return (-1);
280 }
281
282 /*
283 * Finally, see if there are any trail files to expire.
284 */
285 err = auditd_expire_trails(audit_warn_expired);
286 if (err)
287 auditd_log_err("auditd_expire_trails(): %s",
288 auditd_strerror(err));
289
290 return (0);
291}
292
293/*
294 * Start up auditing.
295 */
296static void
297audit_setup(void)
--- 259 unchanged lines hidden (view full) ---
557 break;
558
559 case AUDIT_TRIGGER_INITIALIZE:
560 auditd_log_info("Got audit initialize trigger");
561 if (au_state == AUD_STATE_DISABLED)
562 audit_setup();
563 break;
564
565 case AUDIT_TRIGGER_EXPIRE_TRAILS:
566 auditd_log_info("Got audit expire trails trigger");
567 err = auditd_expire_trails(audit_warn_expired);
568 if (err)
569 auditd_log_err("auditd_expire_trails(): %s",
570 auditd_strerror(err));
571 break;
572
573 default:
574 auditd_log_err("Got unknown trigger %d", trigger);
575 break;
576 }
577}
578
579/*
580 * Reap our children.
--- 103 unchanged lines hidden (view full) ---
684 auditd_log_debug(
685 "Set audit trail min free percent in kernel.");
686
687 /*
688 * Configure host address in the audit kernel information.
689 */
690 err = auditd_set_host();
691 if (err) {
692 if (err == ADE_PARSE) {
693 auditd_log_notice(
694 "audit_control(5) may be missing 'host:' field");
695 } else {
696 auditd_log_err("auditd_set_host() %s: %m",
697 auditd_strerror(err));
698 ret = -1;
699 }
700 } else
701 auditd_log_debug(
702 "Set audit host address information in kernel.");
703
704 return (ret);
705}
706
707/*
708 * Setup and initialize auditd.
709 */
710static void
711setup(void)
--- 111 unchanged lines hidden ---